Disabled launchctl reports incorrectly (Ventura) #227

New Issue

michael · 2026-01-19T18:29:44Z

michael commented

2026-01-19 18:29:44 +00:00

Originally created by @jmahlman on GitHub.

Originally assigned to: @golbiga, @brodjieski on GitHub.

Summary

MacOS Ventura changes how launchctl reports disabled services. Previously, the check /bin/launchctl print-disabled system for a service would return => true if it was disabled. Ventura has changed this to => disabled. For example:

The check for ssh on Monterey /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => true' would work but on Ventura this will now be /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => disabled'.

The affected rules are:
os_httpd_disable, os_nfsd_disable, os_tftpd_disable, os_uucp_disable, system_settings_screen_sharing_disable, system_settings_smbd_disable, system_settings_ssh_disable

Steps to reproduce

Build a baseline script with the Ventura guidance that includes any of the following checks: os_httpd_disable, os_nfsd_disable, os_tftpd_disable, os_uucp_disable, system_settings_screen_sharing_disable, system_settings_smbd_disable, system_settings_ssh_disable
Run the baseline script and then audit the system

Operating System version

macOS 13 Ventura Beta (22A5331f)

What is the current bug behavior?

The scan will successfully run and remediate but the audit will not report properly.

What is the expected correct behavior?

The audit should report correctly.

Output of checks

Sample check on Monterey:

➜  ~ /bin/launchctl print-disabled system | grep apple
	"com.apple.atrun" => false
	"com.apple.AEServer" => true
	"com.apple.ManagedClientAgent.enrollagent" => false
	"com.apple.screensharing" => true
	"com.apple.CSCSupportd" => true
	"com.apple.ftpd" => true
	"com.apple.mdmclient.daemon.runatboot" => false
	"com.apple.nfsd" => true
	"com.apple.smbd" => true
	"com.apple.bootpd" => true
	"com.apple.ftp-proxy" => true

Sample check on Ventura:

➜  ~ /bin/launchctl print-disabled system | grep apple
	"com.apple.atrun" => disabled
	"com.apple.AEServer" => enabled
	"com.apple.ManagedClientAgent.enrollagent" => enabled
	"com.apple.screensharing" => disabled
	"com.apple.CSCSupportd" => disabled
	"com.apple.ftpd" => disablked
	"com.apple.mdmclient.daemon.runatboot" => enabled
	"com.apple.nfsd" => disabled
	"com.apple.smbd" => disabled

Possible fixes

Update the following rules:
os_httpd_disable, os_nfsd_disable, os_tftpd_disable, os_uucp_disable, system_settings_screen_sharing_disable, system_settings_smbd_disable, system_settings_ssh_disable

Replace any instance of => true with => disabled.

Originally created by @jmahlman on GitHub. Originally assigned to: @golbiga, @brodjieski on GitHub.  ### Summary MacOS Ventura changes how launchctl reports disabled services. Previously, the check `/bin/launchctl print-disabled system` for a service would return `=> true` if it was disabled. Ventura has changed this to `=> disabled`. For example: The check for ssh on Monterey `/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => true'` would work but on Ventura this will now be `/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => disabled'`. The affected rules are: os_httpd_disable, os_nfsd_disable, os_tftpd_disable, os_uucp_disable, system_settings_screen_sharing_disable, system_settings_smbd_disable, system_settings_ssh_disable ### Steps to reproduce 1. Build a baseline script with the Ventura guidance that includes any of the following checks: os_httpd_disable, os_nfsd_disable, os_tftpd_disable, os_uucp_disable, system_settings_screen_sharing_disable, system_settings_smbd_disable, system_settings_ssh_disable 2. Run the baseline script and then audit the system ### Operating System version macOS 13 Ventura Beta (22A5331f) ### What is the current *bug* behavior? The scan will successfully run and remediate but the audit will not report properly. ### What is the expected *correct* behavior? The audit should report correctly. ### Output of checks Sample check on Monterey: ```bash ➜ ~ /bin/launchctl print-disabled system | grep apple "com.apple.atrun" => false "com.apple.AEServer" => true "com.apple.ManagedClientAgent.enrollagent" => false "com.apple.screensharing" => true "com.apple.CSCSupportd" => true "com.apple.ftpd" => true "com.apple.mdmclient.daemon.runatboot" => false "com.apple.nfsd" => true "com.apple.smbd" => true "com.apple.bootpd" => true "com.apple.ftp-proxy" => true ``` Sample check on Ventura: ```bash ➜ ~ /bin/launchctl print-disabled system | grep apple "com.apple.atrun" => disabled "com.apple.AEServer" => enabled "com.apple.ManagedClientAgent.enrollagent" => enabled "com.apple.screensharing" => disabled "com.apple.CSCSupportd" => disabled "com.apple.ftpd" => disablked "com.apple.mdmclient.daemon.runatboot" => enabled "com.apple.nfsd" => disabled "com.apple.smbd" => disabled ``` ### Possible fixes Update the following rules: os_httpd_disable, os_nfsd_disable, os_tftpd_disable, os_uucp_disable, system_settings_screen_sharing_disable, system_settings_smbd_disable, system_settings_ssh_disable Replace any instance of `=> true` with `=> disabled`.

michael closed this issue

2026-01-19 18:29:44 +00:00

michael commented

2026-01-19 18:29:44 +00:00

@jmahlman commented on GitHub:

Forgot to add system_settings_rae_disable :)

@jmahlman commented on GitHub: Forgot to add system_settings_rae_disable :)

michael commented

2026-01-19 18:29:44 +00:00

@golbiga commented on GitHub:

The fixes have been merged into dev_ventura. Closing issue.

@golbiga commented on GitHub: The fixes have been merged into `dev_ventura`. Closing issue.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#227